CVE-2025-61927
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Happy DOM version 19 and lower contains a vulnerability allowing remote code execution (RCE). The Node.js VM context is not isolated, allowing untrusted JavaScript code to escape the VM and access process-level functionality. Version 20.0.0 fixes the issue by disabling JavaScript evaluation by default.
Risk Assessment
Risk of remote code execution on the server if untrusted JavaScript code is run within the Happy DOM environment. An attacker could gain full control over the system.
Recommendation
Upgrade Happy DOM to version 20.0.0 or later. Ensure JavaScript evaluation is disabled if not required.
Other vulnerabilities in Happy DOM
See all- CVE-2025-62410Critical
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
- CVE-2026-118661Medium
Prior to 20.14.6, Happy DOM's CookieContainer does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering applications, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation.
- CVE-2026-118660High
Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can cause server-side requests to arbitrary internal or cloud endpoints.
- CVE-2026-115895High
Happy DOM from 17.0.0 until 21.0.4 in ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating it as a JavaScript binding identifier; with enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can cause generated JavaScript to execute in the Node.js host process.
- CVE-2026-34226High
In Happy DOM library before version 20.8.9, there is a vulnerability where cookies are incorrectly attached when using fetch() with credentials: 'include'. Instead of cookies from the target URL, cookies from the current page origin (window.location) are attached, potentially leaking cookies from origin A to origin B.
- CVE-2026-33943High
A code injection vulnerability in Happy DOM versions 15.10.0 through 20.8.7 allows Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The `ECMAScriptModuleCompiler` directly interpolates unsanitized content into generated code, and the quote filter fails to strip backticks, enabling template literal-based payloads to bypass sanitization.
Original NVD description (English source)
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS